Today the PHP project released emergency updates for two critical vulnerabilities that can let an attacker run code on a web server without logging in. Both are rated 9.2 out of 10 (CVSS v4.0). If your business runs a PHP website or app, including WordPress and most other content management systems, update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. The PHP team says there is no complete workaround.
What the Vulnerabilities Are
Both flaws sit deep inside PHP's request handling, below any website code.
| Vulnerability | What Goes Wrong | Severity |
|---|---|---|
| CVE-2026-109618 | An out-of-memory condition can interrupt PHP while request data is only partly set up. Cleanup then treats that half-built data as valid. | CVSS v4.0 9.2 |
| CVE-2026-109619 | Data from one request can survive after its memory is freed, and a later request on the same worker can use it. | CVSS v4.0 9.2 |
In plain terms, an attacker can send crafted web requests that corrupt PHP's memory and take control of the server process. No login is needed.
Who Is Affected and Why It Matters
According to the PHP project, every installation that serves web traffic is affected. That includes PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest on Apache mod_php, where a demonstrated exploit fires before the website's own code even runs.
PHP powers a large share of the web, so this reaches well beyond developers:
- Company websites on WordPress, Drupal, Joomla or similar platforms
- Client portals, intake forms and booking pages built in PHP
- Internal tools such as ticketing, wikis and line-of-business apps
- Hosted sites where your web host manages PHP for you
If an attacker gets code running on your web server, they can deface the site, steal form submissions and customer data, plant malware for visitors, or use the server as a foothold into the rest of your network. Expect attackers to study the fixes and start scanning for unpatched servers quickly.
What to Do Now
- Find every PHP install. That means websites, portals, internal apps, and anything your web host or developer runs for you. Note which PHP version each one uses.
- Update to a fixed release.
| If You Run | Update To |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 (8.2 reaches end of life on December 31, 2026, so plan an upgrade) |
| PHP 7.4, 8.0 or 8.1 | These are end of life. The PHP project published minimal backport patches, but the real fix is moving to a supported version. |
- Use your Linux vendor's packages if you have them. Vendors received the patches in advance, so updates should already be available.
- Ask your host or developer to confirm in writing that the update is done, if you do not manage the server yourself.
- Restart PHP after updating so the patched version is actually running, then check the version number.
If you truly cannot patch today, the PHP team lists temporary steps that reduce exposure but do not make a server safe: setting memory_limit=-1 (without RLIMIT_AS or RLIMIT_DATA limits), lowering post_max_size, and setting session.upload_progress.enabled=0. Treat these as a bridge of hours, not a fix.
How Trusted Cyber Helps
- Managed clients: we are inventorying PHP across your environment and applying the updates. We will confirm when each system is done.
- Not a managed client? We can find the PHP systems you may not know about, patch them, and check for signs of compromise.
- Websites run by a third party: we can check what version they are running and follow up with your host or developer for you.
Not sure if you run PHP at all? That is the right question to ask today. Contact Trusted Cyber and we will help you find out.